The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/office/soffice.py implements a process injection technique. It contains a C source code string literal that is written to /tmp/lo_socket_shim.c at runtime, compiled into a shared object using gcc -shared -fPIC, and subsequently injected into the LibreOffice (soffice) process via the LD_PRELOAD environment variable. This is intended to shim Unix domain socket calls for compatibility in restricted environments.
[EXTERNAL_DOWNLOADS]: The SKILL.md file instructs the agent to install the docx library globally using npm install -g docx. This is a standard and well-known library for generating Word documents in JavaScript.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant vulnerability surface for indirect prompt injection through the processing of untrusted files:
Ingestion points: The skill is designed to unpack and read content from external Word documents (scripts/office/unpack.py), which are then converted to XML for analysis and modification.
Boundary markers: While it uses XML structure as a natural delimiter, there are no explicit instructions to the model to ignore embedded commands within the document text itself.
Capability inventory: The skill has high system capabilities, including the ability to execute shell commands (soffice, gcc, git, pdftoppm) and perform extensive file system operations (found in scripts/accept_changes.py, scripts/office/soffice.py, and scripts/office/validators/redlining.py).
Sanitization: The implementation uses defusedxml.minidom in its validation modules to protect against XML External Entity (XXE) and other XML-based injection attacks.

docx